From 4350d750a685a1db955e262aa9ad3ef440aa026c Mon Sep 17 00:00:00 2001
From: Jafar Akhondali <jafar.akhoondali@gmail.com>
Date: Tue, 30 Jul 2024 19:25:45 +0200
Subject: [PATCH] Block malicious looking requests to prevent path traversal
 attacks.

---
 web_assembly/ch3/app.js | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/web_assembly/ch3/app.js b/web_assembly/ch3/app.js
index f1284fd..27add36 100644
--- a/web_assembly/ch3/app.js
+++ b/web_assembly/ch3/app.js
@@ -9,6 +9,12 @@ const projectName = "calculate_primes";
  * dependency 없는 간단한 static web server
  */
 const server = http.createServer((req, res) => {
+    if (path.normalize(decodeURI(req.url)) !== decodeURI(req.url)) {
+        res.statusCode = 403;
+        res.end();
+        return;
+    }
+
   const relativePath = req.url.substr(1);
   const filePath = path.resolve(__dirname, relativePath);
   const ext = req.url.substr(req.url.lastIndexOf(".") + 1);